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WE CLAIM: 

1. A computer program product vfbr detecting an outbreak of a computer virus on 
a computer apparatus, said computer program product comprising: 

(i) measurement computer code operable to measure one or more 
measurement parameters indicative of non virus specific activity of 
said computer apparatus over a respective measurement period; 

(ii) comparison computer code operable to compare said one or more 
measurement /parameters with respective predetermined threshold 
levels; and 

(iii) signal generating computer code operable to generate a signal 
indicative/of an outbreak of a computer virus if one or more of said one 
or more /measurement parameters crosses a respective predetermined 
threshold level. 



2. A computer pro^ 
measurement parameter 
messag^itfeT 



-product as claimed in claim 1, wherein one of said 
iov\many e-njaiHnessages are sent having an identical 
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3. A computer program product as (claimed in claim 1, wherein one of said 
measurement parameters is how many e-mail messages are sent having an identical 
file attachment. 
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4. A computer program product/as claimed in claim 1, wherein one of said 
measurement parameters is how n/any e-mail messages are sent having a file 
attachment of a given file type. 

5. A computer program product as claimed in claim 4, wherein said given file 
type is an executable file type. 



5 6. A computer program product as claimed in claim 1, wherein one of said 
measurement parameters is e-mail throughput within said computer system. 
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7. A computer program product /as claimed in claim 6, wherein each e-mail 
processed has an associated size value and e-mail throughput is measured in a form 



dependent upon a number of e-mails 
mails. 



8. A computer program product 
predetermined threshold levels are vafried 



multiplied by a total of size values for said e- 



as claimed in claim 1, wherein said respective 
in dependence upon time of day. 



9. A computer program product as claimed in claim 1, wherein said respective 
predetermined threshold levels are varied in dependence upon day of week. 



10. A computer program produc 
20 measurement parameters are user sz. 



as claimed in claim 1 , wherein said one or more 
ectable. 



11. A computer program product as claimed in claim 1 , wherein said respective 
measurements periods are user seledtable. 



25 12. A computer program 

predetermined threshold levels are 



produfct as claimed in claim 1, wherein said respective 
v ser selectable. 



13. A method of detecting an outbreak of a computer virus on a computer 
apparatus, said method comprising the steps of: 

(i) measuring one or more measurement parameters indicative of non 
virus specific activity of said computer apparatus over a respective 
measurement perio I; 
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(ii) 
(iii) 



comparing said one or more measurement parameters with respective 
predetermined threshold levels; and 

generating a signal indicative of an outbreak of a computer virus if one 
or more of said one or more measurement parameters crosses a 
respective predetermined threshold level. 



14. A method as claimed 
parameters is how many e-mai 




13, wherein one of said measurement 
aving an identical message title. 



15. A method as claimed in claim 13, wherein one of said measurement 
15 parameters is how many e-mail messages are sent having an identical file attachment. 

16. A method as claimed in claim 13 J wherein one of said measurement 
parameters is how many e-mail messages are §ent having a file attachment of a given 
file type. 

20 

17. A method as claimed in claim 16, wherein said given file type is an executable 
file type. 

18. A method as claimed in claim /l3, wherein one of said measurement 
25 parameters is e-mail throughput within saiq computer system. 
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19. A method as claimed in claim 18, wherein each e-mail processed has an 
associated size value and e-mail throughput is measured in a form dependent upon a 



number of e-mails multiplied by a total o 

20. A method as claimed in claim 
threshold levels are varied in dependence 



size values for said e-mails. 

13, wherein said respective predetermined 
upon time of day. 
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21. A method as claimed 



threshold levels are varied in dependence upon day of week 



22. A method as claimed 
parameters are user selectable. 

23. A method as claimed 
periods are user selectable. 



24. A method as claimed 
threshold levels are user selectable 
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(i) 



in claim 13, wherein said respective predetermined 



in claim 13, wherein said one or more measurement 



in claim 13, wherein said respective measurements 



in claim 13, wherein said respective predetermined 



Apparatus for detecting an outbreak of a computer virus on a computer 
apparatus, said apparat as comprising: 

measuring logic operable to measure one or more measurement 
parameters indicative of non virus specific activity of said computer 
a respective measurement period; 

c operable to compare said one or more measurement 
parameters with respective predetermined threshold levels; and 

signal general ing logic operable to generate a signal indicative of an 
computer virus if one or more of said one or more 
measurement parameters crosses a respective predetermined threshold 
level. 



(ii) 
(iii) 



apparatus over 
comparing log 



26. Apparatus as claimed 
parameters is how many e-mail 




one of said measurement 
are sent having an identical message title. 



27. Apparatus as claimed in claim 25, Wherein one of said measurement 
parameters is how many e-mail messages are seiit having an identical file attachment. 



28. Apparatus as claimed in claim 25, wherein one of said measurement 
parameters is how many e-mail messag^p are sent having a file attachment of a given 
file type. 

10 29. Apparatus as claimed in claim ^8, wherein said given file type is an executable 
file type. 
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30. Apparatus as claimed in /claim 25, wherein one of said measurement 
parameters is e-mail throughput wiuiin said computer system. 

31. Apparatus as claimed in /claim 30, wherein each e-mail processed has an 
associated size value and e-mail throughput is measured in a form dependent upon a 
number of e-mails multiplied by a total of size values for said e-mails. 



20 32. Apparatus as claimed in claim 25, wherein said respective predetermined 
threshold levels are varied in dependence upon time of day. 

33. Apparatus as claimed Jin claim 25, wherein said respective predetermined 
threshold levels are varied in dependence upon day of week. 
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34. Apparatus as claimed} in claim 25, wherein said one or more measurement 
parameters are user selectabld 



35. Apparatus as claimed in claim 25, wherein said respective measurements 
30 periods are user selectable. 



36. Apparatus as clain ed in claim 25, wherein said respective predetermined 
threshold levels are user se ectable. 



